This is in response to your letter, dated February 1, 2005, concerning the Family Educational Rights and Privacy Act (FERPA) as it relates to a request for information from a student's education records under the Texas Public Information Act (PIA). (Tex. Gov't Code §552.) This Office administers FERPA and is responsible for providing technical assistance to educational agencies and institutions to ensure compliance with the statute and regulations. 20 U.S.C. §1232g; 34 CFR Part 99.

Specifically, the [School District] (District) provided a redacted copy of a report that was written by a student concerning an incident [ ] to the [media], in response to a request under the PIA. The District removed personally identifiable information from the education record, in accordance with FERPA, before providing the report to the [media]. The newspaper filed a complaint with the Texas Office of the Attorney General (OAG) because it believed that the District redacted too much of the student report. The OAG requested that the District provide an unredacted copy of the student's report to its Open Records Division (ORD) for review and so that it may make a determination in the complaint filed by the [media]. The District refused to provide the OAG with a copy of the education records because it believes that FERPA does not authorize it to do so.

In follow-up to a telephone conversation with Kay Hastings and Brenda Loudermilk in your office on January 27, 2005, and in response to a request from the District, we were asked to review this document that the District redacted. The OAG asked that the District either provide an unredacted copy of the record to the OAG's ORD or to this Office for review in order to ascertain whether the District had redacted too much information from the education record for release under the PIA. The District also asked this Office for guidance whether FERPA would permit a school district to disclose education records in unredacted form to the OAG for the purpose of making a determination on a complaint filed under the PIA. Enclosed is a copy of our response to the District regarding the redacted report. As explained more fully below, FERPA does not permit the District to disclose personally identifiable information from students' education records to the OAG, without prior written parental consent, for the purpose of determining whether the District is in compliance with the PIA.

In your letter to this Office, you state the following:

The PIA generally requires a governmental body to seek an open records ruling from this office when it wishes to withhold requested information from disclosure. In Open Records Decision No. 634 (1995), for reasons explained in that decision, the Attorney General determined that the PIA does not require an educational agency or institution to request an attorney general decision as to personally identifiable nondirectory information in an " education records" as defined by FERPA. The Attorney General also concluded in that decision that an educational agency or institution may withhold from public disclosure information that is protected by FERPA and excepted from required public disclosure by section 552.101 as "information considered to be confidential by law," without the necessity of requesting an attorney general decision as to that exception.

However, if an educational agency or institution chooses to seek an open records ruling from [the ORD] on the applicability of FERPA or any exception to required disclosure, it must comply with the PIA's procedures for seeking a ruling, including section 552.303. Section 552.303 of the PIA states that "[a] governmental body that requests an attorney general decision shall supply to the Attorney General, in accordance with section 552.301, the specific information requested." In 1998, in a letter to David Anderson, Chief Counsel, Texas Education Agency [TEA], you informed Mr. Anderson that educational agencies and institutions subject to FERPA "may disclose personally identifiable information from education records, without first obtaining the parent's prior written consent, when the agency or institution seeks advice from the Attorney General where a particular disclosure would violate FERPA." As you noted in that letter, section (b)(5) of FERPA permits the release of education records to state officials which may be necessary in connection with the enforcement of the federal legal requirements of any federal or state education program, including to the Attorney General for the enforcement of FERPA. In reliance on this letter from your office, numerous Texas educational agencies and institutions seek an open records ruling from this office on whether they must withhold requested information based on FERPA. In the open records ruling process, this office reviews education records to determine what redactions, if any, are appropriate under FERPA.

In this case, the District did not ask the Texas Attorney General for a ruling, which, as you explained in your letter, it is not required to do.

FERPA protects the privacy interests of parents and students in a student's "education records." Educational agencies and institutions subject to FERPA may not have a policy or practice of permitting the release of or providing access to "education records, or personally identifiable information contained therein other than directory information … without the written consent of their parents…" except as provided by statute. 20 U.S.C. §1232g(b)(1) and (b)(2); 34 CFR §99.30. All FERPA rights transfer from parents to students when the student reaches 18 years of age or attends a postsecondary institution. 20 U.S.C. §1232g(d); 34 CFR §99.3 ("Eligible student").

Under FERPA, "education records" are defined as

those records, files, documents, and other materials which -
(i) contain information directly related to a student; and
(ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.

20 U.S.C. §1232g(a)(4)(A); 34 CFR §99.3 ("Education records").

One exception to the prior written consent requirement in FERPA allows an educational agency or institution to disclose education records to "authorized representatives of … State and local educational authorities… in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements which relate to those programs." 34 CFR §99.31(a)(3)(iv) and 99.35(a); 20 U.S.C. §1232g(b)(3) and (b)(5). Information that is collected under this provision must:

Be protected in a manner that does not permit personal identification of individuals by anyone except the officials referred to in paragraph (a) of this section; and

Be destroyed when no longer needed for the purposes listed in paragraph (a) of this section.

34 CFR §99.35(b).

As you noted, this Office advised Mr. Anderson by letter dated April 29, 1998, that FERPA would permit the nonconsensual disclosure of personally identifiable information from students' education records to the OAG in connection with the "enforcement of or compliance with Federal legal requirements" that relate to Federal or State supported education programs. See 20 U.S.C. §1232g(b)(1)(C), (b)(3), and (b)(5); 34 CFR §99.31(a)(3)(iii) and 99.35. The premise in our reasoning - which was not made explicit in the letter - was that the OAG could act as an "authorized representative" of the TEA for the purpose of "enforcement of or compliance with Federal legal requirements" concerning FERPA. Subsequent to issuing that letter, we had an opportunity to address a related issue and, in doing so, clarified the meaning of the term "authorized representative." As explained below, we conclude that the OAG is not "authorized representative" of the TEA or of school districts in Texas under this FERPA exception to the consent requirement.

On January 30, 2003, the Department issued guidance that addressed the issue of whether FERPA permits a State or local educational authority, such as the TEA or local school districts, to authorize or designate another State agency as its "authorized representative" in order to conduct data matching with the other entity. This memorandum (a copy which is enclosed) was issued to all Chief State School Officers on January 30, 2003, by former Deputy Secretary William D. Hansen and is available on this Office's website (http://www.ed.gov/policy/gen/guid/fpco/pdf/ht031103.pdf) The Deputy Secretary's memorandum rescinded previous Department guidance that relied on an expansive interpretation of the term "authorized representative" in §99.31(a)(3) to support data matching with state labor departments and other non-educational agencies in order to meet Workforce Investment Act and other Federal reporting requirements. It grew out of concern that unlimited discretion to appoint or designate an "authorized representative" for data matching purposes essentially vitiates the specific conditions for nonconsensual disclosure under §§99.31(a)(3) and 99.35 and, more generally, FERPA's prohibition on disclosure without written consent.

As explained in our February 2004 letters to the California and Pennsylvania Departments of Education -

The memo explains that multiple references to "officials" in the statutory text for this exception reflect congressional concern that the "authorized representatives" of a State educational authority (or other official listed in §99.31(a)(3)) must be under the direct control of that authority, which means an employee, appointed official, or "contractor."

"Contracting" in this sense means outsourcing or using third-parties to provide services that the State educational authority would otherwise provide for itself, in circumstances where internal disclosure would be appropriate under §99.35 if the State educational authority were providing the service itself, and where the parties have entered into an agreement that establishes the State educational authority's direct control over the contractor with respect to the service provided by the contractor. Any contractor that obtains access to personally identifiable information from education records in these circumstances is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under §99.35, and the State educational authority is responsible for ensuring that its contractor does not redisclose or allow any other party to have access to any personally identifiable information from education records.

"Authorized representatives" may include outside legal counsel retained by a State educational authority in circumstances where internal disclosure would be appropriate under §99.35 if the service were provided in-house and where outside counsel is bound by the same restrictions on redisclosure and destruction of information that apply to the State educational authority itself under §99.35.

It is our understanding that OAG does not serve as outside legal counsel under the direct control of the District in this matter in accordance with the requirements discussed above. Since the OAG is neither a "State educational authority" nor an authorized representative of a State educational authority, as discussed above, the District may not disclose personally identifiable information from education records to the OAG, without consent, under §99.31(a)(3) and 99.35 of the FERPA regulations. Furthermore, the District's situation is distinguishable from that discussed in our 1998 letter to the TEA because the OAG is not seeking to review this information in connection with the District's compliance with FERPA, but rather to resolve the requestor's complaint about the District compliance with the PIA. FERPA does not require educational agencies and institutions to redact the minimum information necessary in order to provide the maximum information possible to an outside party requesting access under State open records laws. Since only parents and eligible students have a right to inspect and review education records under FERPA, there is no FERPA compliance issue if the District removes more than the absolute minimum of personally identifiable information when disclosing records, without consent, to a third party. For these reasons, FERPA does not permit an educational agency or institution in Texas to disclose, without parental consent, education records to the OAG for the purpose of determining whether it has complied with the PIA or whether it has redacted more than is necessary under FERPA.

I trust that the above information is helpful in explaining the scope and limitations of FERPA as it relates to this matter. Enclosed is a copy of our letter to [the District], in which we discuss the manner in which educational agencies and institutions may disclose records in non-personally identifiable format without violating FERPA. If you have any questions about this guidance, please do not hesitate to contact us.